CVE-2026-85426
MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names without sanitization. Attackers can inject shell metacharacters into client names to execute arbitrary commands as the uMemWatch process user through unquoted redirection targets in system calls.
- Published Sep 3, 2026
- CVSS 9.3 critical
- 0.9% chance of exploitation in the next 30 days (EPSS)
- A fix is available